English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Link virus

Viruses are often classified according to the technique they use to infect. A link virus, as the name suggests, does not add its code directly to infected files. Instead, it spreads by manipulating the way files are accessed under the FAT file system.

When an infected file is run, the virus goes memory resident and a writes a (typically hidden) file to the disk: this file contains the virus code. Subsequently, the virus modifies the FAT to cross-link other files to the disk sector containing the virus code. The result is that whenever the infected file is run, the system jumps first to the virus code and runs it.

The cross-linking is detectable if the CHKDSK program is run, although a virus could use stealth to conceal the changes if the virus was in memory (in other words, if the user did not boot from a clean system disk).